Splunk Search

Windows Security Logs: Regex Filtering Search time

arrowsmith3
Path Finder

I have a windows security event that I am trying to extract a custom field for failed logon events. The problem I have is there are two duplicate categories and the text I am after is in the second category:

Ex:
Subject:
Security ID: S-1-0-0
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed:
Security ID: S-1-0-0
Account Name: PCVS Operator
Account Domain: PCVSB681-2

Normally I would just put in rex "Account Name:(?.+)" to extract the content of this field but since there is two of them, is there a way to skip the first field and go directly to the second?

Thanks!

Tags (3)
0 Karma
1 Solution

arrowsmith3
Path Finder

This resolved my question, thanks goes to ziegfried.

rex "(?ms)Account For Which Logon Failed.+?Account Name:\s+(?\V+)"

View solution in original post

0 Karma

arrowsmith3
Path Finder

This resolved my question, thanks goes to ziegfried.

rex "(?ms)Account For Which Logon Failed.+?Account Name:\s+(?\V+)"

0 Karma

arrowsmith3
Path Finder

Thank you but that didnt work, when I apply that to my search string it will list the entire content of the event.

Any other suggestions?

0 Karma

_d_
Splunk Employee
Splunk Employee

Try this:

| rex "(?ms)Account Name.*Account Name:(?<account>.+)"

Hope it helps.

> please upvote and accept answer if you find it useful - thanks!

Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...